/src/cms_transform_extended_fuzzer.c
Line | Count | Source |
1 | | /* Copyright 2022 Google LLC |
2 | | Licensed under the Apache License, Version 2.0 (the "License"); |
3 | | you may not use this file except in compliance with the License. |
4 | | You may obtain a copy of the License at |
5 | | http://www.apache.org/licenses/LICENSE-2.0 |
6 | | Unless required by applicable law or agreed to in writing, software |
7 | | distributed under the License is distributed on an "AS IS" BASIS, |
8 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
9 | | See the License for the specific language governing permissions and |
10 | | limitations under the License. |
11 | | */ |
12 | | |
13 | | #include <stdint.h> |
14 | | #include "lcms2.h" |
15 | | |
16 | | // An extended cmsDoTransform fuzzer. The idea is to include a range of |
17 | | // input/output source formats. |
18 | | |
19 | | void |
20 | | run_test(const uint8_t *data, |
21 | | size_t size, |
22 | | uint32_t intent, |
23 | 6.61k | uint32_t flags, int dstVal) { |
24 | 6.61k | if (size < 2) { |
25 | 2 | return; |
26 | 2 | } |
27 | | |
28 | 6.61k | cmsHPROFILE srcProfile = cmsOpenProfileFromMem(data, size); |
29 | 6.61k | if (!srcProfile) return; |
30 | | |
31 | | // Select dstProfile and dstFormat |
32 | 5.75k | cmsHPROFILE dstProfile; |
33 | 5.75k | uint32_t dstFormat; |
34 | 5.75k | if (dstVal == 1) { |
35 | 533 | dstProfile = cmsCreateLab4Profile(NULL); |
36 | 533 | dstFormat = TYPE_Lab_8; |
37 | 533 | } |
38 | 5.22k | else if (dstVal == 2) { |
39 | 705 | dstProfile = cmsCreateLab2Profile(NULL); |
40 | 705 | dstFormat = TYPE_LabV2_8; |
41 | 705 | } |
42 | 4.51k | else if (dstVal == 3) { |
43 | 217 | cmsToneCurve* gamma18; |
44 | 217 | gamma18 = cmsBuildGamma(0, 1.8); |
45 | 217 | dstProfile = cmsCreateGrayProfile(NULL, gamma18); |
46 | 217 | cmsFreeToneCurve(gamma18); |
47 | 217 | dstFormat = TYPE_GRAY_FLT | EXTRA_SH(1); |
48 | 217 | } |
49 | 4.29k | else if (dstVal == 4) { |
50 | 626 | dstProfile = cmsCreateXYZProfile(); |
51 | 626 | dstFormat = TYPE_XYZ_16; |
52 | 626 | } |
53 | 3.67k | else if (dstVal == 5) { |
54 | 308 | dstProfile = cmsCreateXYZProfile(); |
55 | 308 | dstFormat = TYPE_XYZ_DBL; |
56 | 308 | } |
57 | 3.36k | else if (dstVal == 6) { |
58 | 418 | dstProfile = cmsCreateLab4Profile(NULL); |
59 | 418 | dstFormat = TYPE_Lab_DBL; |
60 | 418 | } |
61 | 2.94k | else if (dstVal == 7) { |
62 | 395 | dstProfile = cmsCreateLab4Profile(NULL); |
63 | 395 | dstFormat = TYPE_Lab_DBL; |
64 | 395 | } |
65 | 2.55k | else if (dstVal == 8){ |
66 | 277 | dstProfile = cmsCreate_OkLabProfile(NULL); |
67 | 277 | dstFormat = (FLOAT_SH(1)|COLORSPACE_SH(PT_MCH3)|CHANNELS_SH(3)|BYTES_SH(0)); |
68 | 277 | } |
69 | 2.27k | else if (dstVal == 9){ |
70 | 385 | dstProfile = cmsCreateNULLProfile(); |
71 | 385 | dstFormat = 0; |
72 | 385 | } |
73 | 1.89k | else if (dstVal == 10){ |
74 | 496 | dstProfile = cmsCreateBCHSWabstractProfile(17, 0, 1.2, 0, 3, 5000, 5000); |
75 | 496 | dstFormat = TYPE_Lab_DBL; |
76 | 496 | } |
77 | 1.39k | else { |
78 | 1.39k | dstProfile = cmsCreate_sRGBProfile(); |
79 | 1.39k | dstFormat = TYPE_RGB_8; |
80 | 1.39k | } |
81 | | |
82 | 5.75k | if (!dstProfile) { |
83 | 0 | cmsCloseProfile(srcProfile); |
84 | 0 | return; |
85 | 0 | } |
86 | | |
87 | | // Extract srcFormat from the random src profile |
88 | 5.75k | cmsColorSpaceSignature srcCS = cmsGetColorSpace(srcProfile); |
89 | 5.75k | cmsUInt32Number nSrcComponents = cmsChannelsOf(srcCS); |
90 | 5.75k | cmsUInt32Number srcFormat; |
91 | 5.75k | if (srcCS == cmsSigLabData) { |
92 | 519 | if (dstVal != 7) { |
93 | 504 | srcFormat = |
94 | 504 | COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0); |
95 | 504 | } |
96 | 15 | else { |
97 | 15 | srcFormat = |
98 | 15 | COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0) | FLOAT_SH(1); |
99 | 15 | } |
100 | 5.23k | } else { |
101 | 5.23k | srcFormat = |
102 | 5.23k | COLORSPACE_SH(PT_ANY) | CHANNELS_SH(nSrcComponents) | BYTES_SH(1); |
103 | 5.23k | } |
104 | | |
105 | | // Create the transform |
106 | 5.75k | cmsContext ctx = cmsCreateContext(NULL, NULL); |
107 | 5.75k | cmsHTRANSFORM hTransform = cmsCreateTransformTHR( |
108 | 5.75k | ctx, |
109 | 5.75k | srcProfile, |
110 | 5.75k | srcFormat, |
111 | 5.75k | dstProfile, |
112 | 5.75k | dstFormat, |
113 | 5.75k | intent, |
114 | 5.75k | flags); |
115 | | |
116 | 5.75k | cmsCloseProfile(srcProfile); |
117 | 5.75k | cmsCloseProfile(dstProfile); |
118 | 5.75k | if (!hTransform) { |
119 | 4.47k | cmsDeleteContext(ctx); |
120 | 4.47k | return; |
121 | 4.47k | } |
122 | | |
123 | | |
124 | | // Do transformation. |
125 | | // The output buffer type depends on the dstFormat |
126 | | // The input buffer type depends on the srcFormat. |
127 | 1.28k | if (T_BYTES(srcFormat) == 0) { // 0 means double |
128 | | // Ensure output is large enough |
129 | 5 | long long output[nSrcComponents*4]; |
130 | 5 | double input[nSrcComponents]; |
131 | 20 | for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 0.5f; |
132 | 5 | cmsDoTransform(hTransform, input, output, 1); |
133 | 5 | } |
134 | 1.27k | else { |
135 | 1.27k | uint8_t input[nSrcComponents]; |
136 | 5.60k | for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 128; |
137 | | |
138 | 1.27k | if (dstFormat == TYPE_XYZ_16) { |
139 | 79 | cmsCIEXYZ output_XYZ = { 0, 0, 0 }; |
140 | 79 | cmsDoTransform(hTransform, input, &output_XYZ, 1); |
141 | 79 | } |
142 | 1.20k | else if (dstFormat == TYPE_XYZ_DBL) { |
143 | 65 | cmsCIEXYZTRIPLE out[4]; |
144 | 65 | cmsDoTransform(hTransform, input, out, 1); |
145 | 65 | } |
146 | 1.13k | else if (dstFormat == TYPE_Lab_DBL || dstFormat == (FLOAT_SH(1)|COLORSPACE_SH(PT_MCH3)|CHANNELS_SH(3)|BYTES_SH(0))) { |
147 | 367 | cmsCIELab Lab1; |
148 | 367 | cmsDoTransform(hTransform, input, &Lab1, 1); |
149 | 367 | } |
150 | 768 | else { |
151 | 768 | uint8_t output[4]; |
152 | 768 | cmsDoTransform(hTransform, input, output, 1); |
153 | 768 | } |
154 | 1.27k | } |
155 | 1.28k | cmsDeleteTransform(hTransform); |
156 | 1.28k | cmsDeleteContext(ctx); |
157 | 1.28k | } |
158 | | |
159 | | |
160 | 13.6k | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
161 | 13.6k | if (size < 12) { |
162 | 12 | return 0; |
163 | 12 | } |
164 | | |
165 | 13.6k | uint32_t flags = *((const uint32_t *)data+0); |
166 | 13.6k | uint32_t intent = *((const uint32_t *)data+1) % 16; |
167 | 13.6k | int decider = *((int*)data+2) % 11; |
168 | 13.6k | data += 12; |
169 | 13.6k | size -= 12; |
170 | | |
171 | | // Transform using various output formats. |
172 | 13.6k | run_test(data, size, intent, flags, decider); |
173 | | |
174 | 13.6k | return 0; |
175 | 13.6k | } |